tuf: add debug info if tuf update fails

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Summary

• Adds debug info (the state of the remote repository) if a TUF update fails.

Ticket Link

Related sigstore/root-signing#166

Release Note

Example output (I manually edited one file so sigs would fail):

$ rm -r $HOME/.sigstore && ./cosign initialize --mirror http://localhost:8001
Error: updating local metadata and targets: error updating to TUF remote mirror: tuf: failed to decode timestamp.json: tuf: signature verification failed
remote status:{
	"mirror": "http://localhost:8001",
	"metadata": {
		"root.json": {
			"version": 2,
			"len": 5297,
			"expiration": "11 May 22 19:09 UTC"
		},
		"snapshot.json": {
			"version": 24,
			"len": 1659,
			"expiration": "29 Apr 22 00:54 UTC"
		},
		"targets.json": {
			"version": 2,
			"len": 4167,
			"expiration": "11 May 22 19:10 UTC"
		},
		"timestamp.json": {
			"version": 24,
			"len": 720,
			"expiration": "29 Apr 22 00:54 UTC"
		}
	}
}

[codecov-commenter]

Codecov Report

Merging #1766 (e777d62) into main (1bd6871) will increase coverage by 0.13%.
The diff coverage is 55.20%.

@@            Coverage Diff             @@
##             main    #1766      +/-   ##
==========================================
+ Coverage   31.26%   31.39%   +0.13%     
==========================================
  Files         144      144              
  Lines        8830     8879      +49     
==========================================
+ Hits         2761     2788      +27     
- Misses       5741     5755      +14     
- Partials      328      336       +8     

Impacted Files	Coverage Δ
pkg/cosign/tuf/client.go	62.50% <55.20%> (-1.14%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1bd6871...e777d62. Read the comment docs.

[haydentherapper]

Is there a struct defined in go-tuf we can use? For timestamp, can we use https://github.com/theupdateframework/go-tuf/blob/5b81b7e5604bfae2f0dcecd041e2e44f0128c992/data/types.go#L310?

[asraa]

It's a private struct, not exported in go-tuf. I don't really want to condition on metadata type though, and all metadata defines these three.